A command injection vulnerability in HP Linux Imaging and Printing Software enables an attacker to execute arbitrary system commands. The flaw, classified as CWE-77 and CWE-78, can allow a malicious user to run commands with the privileges of the imaging service, potentially escalating to root and gaining full system control. The vulnerability is specifically identified as a potential escalation of privileges and/or arbitrary code execution via operating system command injection.

The HP Linux Imaging and Printing Software product distributed by HP Inc. on Linux platforms is affected. No specific version information is disclosed, so all deployed instances should be examined for this risk.

The vulnerability scores a CVSS of 8.5, indicating high severity. EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred as command injection through the imaging service, which could be local or remote depending on how the service is exposed. The high CVSS score combined with the potential for arbitrary code execution represents a serious risk if exploited.